CVE-2024-58350

4.0 Moyenne

Publiée le 10/06/2026 à 16:16 · Modifiée le 15/07/2026 à 01:17 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

Ghidra before 11.2 contains a use after free vulnerability in the Sleigh backend caused by undefined static initialization order of the SleighArchitecture::translators and XmlArchitectureCapability singletons. Attackers can trigger an infinite loop or denial of service during shutdown by exploiting the unsafe destruction order that causes iteration over deallocated memory.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	2.1 Faible	disclosure@vulncheck.com	`CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	2.9 Faible	disclosure@vulncheck.com	`CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L`
3.1	4.0 Moyenne	nvd@nist.gov (NVD)	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

Faiblesses (CWE)

CWE-758

Références

https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-4g43-2f29-xvp4 Vendor Advisory
https://www.vulncheck.com/advisories/ghidra-use-after-free-in-sleigh-backend-via-static-initialization-order Third Party Advisory

CVE-2024-58350

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs